But the same class of device that currently provides NAT to the end user could just as easily provide a default-deny firewall. It's not as though it's easier for Netgear to implement NAT than a basic firewall.